Password Hell Is Real, and It's Also Now a Bigger Security Hole Than Ever

Everyone has a login horror story now. A parking app that demands a four-digit PIN with arbitrary rules. A password manager that comes up empty at the worst moment. A six-digit code texted to a phone that's sitting in another room.

The Atlantic detailed this frustration in a recent piece, describing a scene familiar to anyone juggling modern digital life: getting locked out of a parking app while three kids wait at a gym door, then discovering the trusty password manager doesn't have the answer. Troy Hunt, the cybersecurity expert who runs Have I Been Pwned, told the outlet the login experience today is "probably worse than ever" because "there's just no consistency."

He's right, and the inconsistency isn't just annoying. It's a security problem.

The pileup nobody asked for

Passwords used to be the whole system. Now they're one layer in a stack that includes browser-based password managers, third-party vaults like 1Password, operating-system tools like Apple's Passwords app, single sign-on through Google or Facebook, SMS codes, authenticator apps, and passkeys. Each one promises to fix the last one's problems. Each one adds a new failure point.

The Atlantic's account describes autofill prompts from 1Password getting covered up by competing iCloud Keychain prompts, a small but telling example of how the tools meant to simplify login now compete with each other for control of the same moment.

In the early 2010s, mass breaches taught services to demand longer, weirder, harder-to-guess passwords. Rules multiplied: a capital letter here, a symbol there, no more than two repeated digits, nothing sequential. The result is passwords no human can remember and no consistent standard across services for how to create or store them.

The attackers didn't wait around

While users were drowning in login friction, attackers found the seams. According to a report from BleepingComputer citing cybersecurity firm Huntress, password-spraying attacks increased 155-fold in the first half of 2026.

One campaign specifically targeted Microsoft's Azure CLI, the command-line tool administrators use to manage Azure and Entra cloud resources. Huntress traced the traffic to an IPv6 range controlled by hosting provider LSHIY LLC. In a two-week window in mid-June, Huntress logged more than 81 million related login attempts and 78 confirmed account compromises.

The attack method itself isn't new. Attackers built lists of valid usernames scraped from LinkedIn, company websites, breach dumps, and phishing. They tested common or previously breached passwords against those accounts slowly enough to dodge lockout thresholds, a technique known as password spraying.

What made this campaign more effective, according to Huntress, was two things working together: attackers reused valid username-password combinations from old breaches that victim organizations had never rotated, and they exploited a legacy authentication method called Resource Owner Password Credentials (ROPC). ROPC, a grant type deprecated under OAuth 2.1, sends a username and password directly to a token endpoint with no interactive multi-factor prompt.

Many of the businesses Huntress observed getting compromised had already deployed multi-factor authentication through a Conditional Access Policy. The MFA just wasn't configured to cover the ROPC flow attackers were using. Andrew "Spike" Brandt, a principal threat intelligence incident commander at Huntress, described the exploited method bluntly: "Even though we call it an authorization method, it's technically an impersonation method."

Huntress said it didn't observe follow-on activity, like lateral movement or data theft, after the successful LSHIY-linked logins. Rich Mozeleski, a staff product manager at Huntress, told BleepingComputer the attacker may simply have been validating stolen credentials for resale on the dark web. LSHIY has since shut down the attacking traffic from that IP range and confirmed the activity came through its bring-your-own-IP service, meaning a customer, not LSHIY itself, was behind the campaign.

Two symptoms, one disease

The Atlantic's piece and the Huntress research describe the same underlying failure from opposite ends. Users are drowning in password requirements and inconsistent tools, so they reuse passwords, forget them, or store them somewhere insecure. Companies bolt on MFA to compensate but configure it inconsistently, leaving legacy authentication paths like ROPC wide open. Attackers don't need to break encryption. They just need to find the one flow nobody locked down.

The 155x figure describes growth in attacks Huntress itself tracked, not a verified industry-wide total. The open question is whether companies fix the configuration gaps Huntress flagged, specifically extending MFA coverage to legacy protocols like ROPC, before the next large-scale credential-stuffing campaign finds the same hole. Microsoft has not been quoted in these reports announcing changes to how ROPC is handled by default in Entra ID.